Bitdefender: 'Midnight Mimosa' Malware Preinstalled on Low-Cost Android Phones in 150+ Countries

5.6 · 8d ago · WORLD · TECH

The Facts

  • Bitdefender researchers uncovered a malware campaign called Midnight Mimosa that infects certain low-cost Android devices via firmware before owners first turn them on. Fox News only
  • Bitdefender says it observed Midnight Mimosa on thousands of unique devices across more than 150 countries over about two years. Fox News only
  • Highest observed numbers were in Mexico, France and Italy, followed by the United States, Germany, Brazil and Spain. Fox News only
  • The affected devices are low-cost, multi-brand Android phones built on MediaTek chipsets, with malicious apps embedded in system software running with elevated privileges. Fox News only
  • The malware can install additional apps without permission, remove existing apps, grant sensitive access to other software, and download and execute code from remote servers. Fox News only
Dive deeper · 6 more factsShow less
  • Malicious components used package names including com.android.system.lite, com.android.sys.prot and com.android.sys.gmsprot. Because they reside in the system partition, a normal uninstall does not remove the infection. Fox News only
  • Infected devices were seen reporting model names associated with Doogee's S200 X and Cubot's KINGKONG X, but Bitdefender's findings do not establish that every phone sold under those names is affected. Fox News only
  • Some devices in the campaign use counterfeit model identifiers imitating Samsung Galaxy and Apple iPhone names, so reported model name is unreliable for verifying authenticity. Fox News only
  • Firmware was found signed with certificates associated with Chinese manufacturer Shenzhen Zediel; Bitdefender said this does not establish the company created the malware or knew of it. Where the code entered the supply chain is unknown. Fox News only
  • The malware appears designed mainly for ad fraud, silently installing disguised utility apps (e.g., weather tools, app lockers) that show hidden ads or generate fake clicks; Bitdefender identified at least 32 such disguised apps. Fox News only
  • Researchers also found related malicious apps on Google Play. Fox News only

Context

Security firm Bitdefender reported a malware campaign, dubbed Midnight Mimosa, that is embedded in the firmware of some low-cost Android phones using MediaTek chipsets. The malware has elevated system privileges and persists through normal uninstall attempts.

The campaign appears aimed at generating revenue through advertising fraud rather than immediate credential theft. Bitdefender said it was seen across more than 150 countries, including the United States, and that the point of infection in the manufacturing or distribution chain remains unknown.

How the Agent Panel Scored This

Independent AI personas each scored importance 1–10; the story's score is a trimmed mean (highest and lowest votes dropped). Vote spread: 2.

6 Informed Citizen A supply-chain firmware malware campaign affecting thousands of devices across 150+ countries is newsworthy and concerns ordinary users with unremovable infections, but the primary harm is ad fraud and it is a single security-firm report with no immediate mass-impact action.
6 Policy Expert A security firm's research disclosure of a firmware-embedded malware campaign affecting thousands of devices across 150+ countries is newsworthy and concerns widespread consumer risk, but it is a private researcher finding with no enacted government action, so it sits in the moderate range.
6 Critical Reader A concrete supply-chain malware discovery affecting thousands of devices across 150+ countries with persistent system-level infection is notable, but it is a single-vendor report with unknown infection origin and mainly ad-fraud impact, limiting breadth of harm.
6 News Editor A newly disclosed firmware-level malware campaign infecting thousands of devices across 150+ countries is a concrete, newsworthy security finding, but its impact is mainly ad fraud on a limited set of low-cost models rather than immediate widespread harm.
5 Science & Tech Analyst A significant supply-chain malware campaign affecting thousands of devices across 150+ countries with persistent system-level infection is newsworthy, but it is mainly ad fraud and tied to a niche set of low-cost devices rather than broad immediate harm.
5 Global Affairs Analyst A significant supply-chain malware campaign infecting thousands of devices across 150+ countries is newsworthy and notable for cybersecurity, but it is mainly ad fraud, not a geopolitical event, so it rates moderate importance.
4 Business Analyst This is a significant cybersecurity disclosure affecting thousands of devices across 150+ countries, but it is a single-firm report with ad-fraud motives, unverified device scope, and no direct market-moving or regulatory action.

Source

← All stories